From: 75670-35815504@requests.muckrock.com 

Sent: Friday, June 21, 2019 12:13 PM 

To: OGC Webmaster 

Subject: Texas Public Information Act Request: Criminal Hackers Target Police 

to Protest Perceived Injustices (Texas Department of Public Safety) 
Attachments: DHS-FBI-HackersTargetPolice.pdf 


Texas Department of Public Safety 
Texas Public Information Act Office 
PO Box 4087 
Austin, TX 78773-0140 

June 21, 2019 

To Whom It May Concern: 

Pursuant to the Texas Public Information Act, I hereby request the following records: 

Records mentioning, describing or generated as a result of the 8 May 2015 Roll Call Release IA- 
0181-15 (which was designed to be shared widely with law enforcement) from the Department 
of Homeland Security's Office of intelligence and Analysis (I&A) in conjunction with the 
Federal Bureau of Investigation, titled "Criminal Hackers Target Police to Protest Perceived 
Injustices," as well as records otherwise responding or reacting to the issues raised in it. 

I am a member of the news media and request classification as such. I have previously written 
about the government and its activities, with some reaching over 100,000 readers in outlets such 
as Gizmodo, MuckRock, Motherboard, Property of the People, Unicorn Riot, and The Outline, 
among others. As such, as I have a reasonable expectation of publication and my editorial and 
writing skills are well established. In addition, I discuss and comment on the files online and 
make them available through non-profits such as the library Internet Archive and the journalist 
non-profit MuckRock, disseminating them to a large audience. While my research is not limited 
to this, a great deal of it, including this, focuses on the activities and attitudes of the government 
itself. 

As my primary purpose is to inform about government activities by reporting on it and making 
the raw data available, I request that fees be waived. 

The requested documents will be made available to the general public, and this request is not 
being made for commercial purposes. 

In the event that there are fees, I would be grateful if you would inform me of the total charges in 
advance of fulfilling my request. I would prefer the request filled electronically, by e-mail 
attachment if available or CD-ROM if not. 



Thank you in advance for your anticipated cooperation in this matter. I look forward to receiving 
your response to this request within 10 business days, as the statute requires. 

Sincerely, 

Emma Best 

Filed via MuckRock.com 

E-mail (Preferred): 75670-35815504@requests.muckrock.com 
Upload documents directly: 

https://accounts.muckrock.com/accounts/login/?next=https%3A%2F%2Fwww.muckrock.com% 

2Faccounts%2Flogin%2F%3Fnext%3D%252Faccounts%252Fagency login%252Ftexas- 

department-public-safetv-621%252Fcriminal-hackers-target-police-to-protest-perceived- 

injustices-texas-department-of-public-safety- 

75670%252F%253Femail%253DOGC.Webmaster%252540dps.texas.gov&url auth token=AA 

AeER-vvXWn9PIMsDBBnignl4Y%3AlheN5t%3AwllsY-5YK08P9hEuwZRGeW7,nMh8 

Is this email coming to the wrong contact? Something else wrong? Use the above link to let us 
know. 

For mailed responses, please address (see note): 

MuckRock News 
DEPT MR 75670 
411A Highland Ave 
Somerville, MA 02144-2516 

PLEASE NOTE: This request is not filed by a MuckRock staff member, but is being sent 
through MuckRock by the above in order to better track, share, and manage public records 
requests. Also note that improperly addressed (i.e., with the requester's name rather than 
"MuckRock News" and the department number) requests might be returned as undeliverable. 
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ROLL CALL RELEASE 

INTELLIGENCE FOR POLICE, FIRE, EMS, AND SECURITY PERSONNEL 


l>V' : 

T^Hjp 

8 May 2015 



(U//FOUO) Criminal Hackers Target Police to Protest Perceived Injustices 

(U//FOUO) Disruptive cyber attacks by criminal hackers—primarily 
distributed-denial-of-service (DDoS) attacks—targeting local law enforcement 
websites have increased since August 2014. We judge that this is almost 
certainly a result of the heightened coverage surrounding the alleged use of 
excessive force by law enforcement and an increased focus on incidents of 
perceived police brutality. The primary impact from the majority of these 
attacks has been the temporary disruption of the targeted public-facing websites. 

» (U//FOUO) In 2014, the Multi-State Information Sharing and Analysis 
Center (MS-ISAC) observed 53 separate incidents of criminal hackers 
conducting cyber operations against state and local entities in response to 
incidents of alleged use of excessive force by law enforcement. The majority of these incidents were low to 
moderate in effect, most frequently resulting in temporary disruption to targeted websites. 



» (U//FOUO) On the morning of 30 December 2014, unknown criminal hackers disabled a Midwestern police 
department’s public website using a DDoS attack. A post later that morning on a US social-networking site 
containing the hashtag “#BlackLives Matter” announced that the targeted website was down. The disabling 
of this website was the third successful attack to disable a law enforcement website in the state within a week— 
the attacks were limited to the temporary disablement of targeted websites, according to DHS field reporting. 


» (U//FOUO) A criminal hacker using the moniker (at)DigitaShadow claimed responsibility on a US social-media site 
for disrupting access to a Northwestern city police department’s website in early December 2014. The DDoS 
attack, which lasted approximately 10 minutes, prevented the department’s in-car terminals from transmitting or 
receiving traffic, including 91 I dispatch requests, according to FBI reporting. 

(U//FOUO) MS-ISAC Distributed-Denial-of-Service Mitigation Recommendations 

(U) Proactive protections include: 

» (U) Establish connections with multiple Internet service providers (ISPs) for redundancy, 

» (U) Ensure service-level agreements with ISPs contain provisions for DoS prevention (such as IP address rotation), 

» (U) Conduct rate-limiting of traffic at the network perimeter, and 

» (U) Create backup, remote-site network infrastructure using multiple addressing schemes. 

(U) Reactive protections include: 

» (U) Execute ISP address rotation, 

» (U) Block source IP addresses generating DoS traffic at enterprise boundary or within ISP infrastructure, and 

» (U) Acquire increased bandwidth capability from the ISP. 

(U//FOUO) See MS-ISAC’s “Guide to DDoS Attacks’’ for additional information: 
http://msisac.cisecurity.org/resources/reports/ documents/GuidetoDDoSAttacks_OOO.pdf. 


(U) Reporting Computer Security Incidents 


(U) To report a computer security incident, either contact US-CERT at 888-282-0870, or go to https://forms.us-cert.gov/report/ and 
complete the US-CERT Incident Reporting System form. The US-CERT Incident Reporting System provides a secure, web-enabled means of 
reporting computer security incidents to US-CERT. An incident is defined as a violation or imminent threat of violation of computer security policies, 
acceptable use policies, or standard computer security practices. In general, types of activity commonly recognized as violating typical security policies 
include attempts (either failed or successful) to gain unauthorized access to a system or its data, including personally identifiable information; unwanted 
disruption or denial of service; the unauthorized use of a system for processing or storing data; and changes to system hardware, firmware, or software 
without the owner’s knowledge, instruction, or consent. 


IA-0181-15 


(U) Prepared by the Office of intelligence and Analysis (l&A). Coordinated with the FBI. This product is intended to provide cybersecurity awareness to federal, state, local, and private sector first responders in matters that 
can affect personnel and network security of their respective organizations. 

(U) Warning: This document is UNCLASSIFIED//FOR OFFICIAL USE ONLY (UIIFOUO). It contains information that may be exempt from public release under the Freedom of Information Act (5 U.S.C. 552). It is to be 
controlled, stored, handled, transmitted, distributed, and disposed of in accordance with DHS policy relating to FOUO information and is not to be released to the public, the media, or other personnel who do not have a valid 
need to know without prior approval of an authorized DHS official. State and local homeland security officials may share this document with authorized critical infrastructure and key resource personnel and private sector 
security officials without further approval from DHS. 


UNCLASSIFIED//FOR OFFICIAL USE ONLY 













